CLAIMS 

What is claimed is: 

1 . A method for monitoring a process, the method comprising: 
creating a signature representative of the process; 
continuously updating the created signature; and 

detecting abnormalities based upon the continuously updated signature. 

2. The method of claim 1 , wherein creating a signature comprises calculating an 
average and a standard deviation. 

3. The method of claim 2, wherein creating a signature comprises accelerated 
learning through incrementally increasing a learning responsiveness ratio. 

4. The method of claim 2, wherein creating a signature comprises initially repeating 
a running average and standard deviation through a plurality of intervals. 

5. The method of claim 1, wherein updating the created signature comprises using a 
weighting factor to ensure that recently recorded data has a greater impact than older data. 

6. The method of claim 1, wherein updating the created signature comprises utilizing 
a moving average over a time to account for events occurring at unexpected times. 

7. The method of claim 1, wherein detecting abnormalities comprises determining if 
measured values are above an upper threshold or below a lower threshold. 

8. The method of claim 1 , further comprising calculating upper and lower threshold 
limits based on jitter offset. 
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9. A computer readable medium having computer executable instructions for 
performing the method of claim 1. 

10. A method for detecting abnormalities occurring during a process based upon a 
continuously updated signature representative of the process, the method comprising: 

continuously monitoring a system parameter; 

computing a normal range of values for the system parameter based on the continuously 
updated signature; 

determining if the monitored system parameter is within the normal range; and 
indicating existence of an abnormality if the monitored system parameter is outside of the 
normal range. 

11. The method of claim 10, further comprising creating a signature by calculating an 
average and a standard deviation. 

12. The method of claim 11, wherein creating a signature comprises accelerated 
learning through incrementally increasing a learning responsiveness ratio. 

13. The method of claim 11, wherein creating a signature comprises initially 
repeating the running average and standard deviation through a plurality of intervals. 

14. The method of claim 10, wherein computing a normal range of values comprises 
using a weighting factor to ensure that recently recorded data has a greater impact than older 
data. 

15. The method of claim 10, wherein computing a normal range of values comprises 
utilizing a moving average over a time to account for events occurring at unexpected times. 
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16. The method of claim 10, wherein determining whether a monitored system 
parameter is within a normal range of values comprises determining if monitored system 
parameters are above an upper threshold or below a lower threshold. 

17. The method of claim 16, further comprising calculating upper and lower threshold 
limits based on jitter offset. 

18. A computer readable medium having computer executable instructions for 
performing the method of claim 10. 

19. A method for creating a signature useful for detecting abnormalities in a 
computing system environment, the method comprising: 

setting a learning responsiveness ratio; 
monitoring a system parameter; 

adjusting the learning responsiveness ratio at fixed intervals until a desired value is 
reached; 

calculating an average and standard deviation for each interval; 
using the average, standard deviation and learning responsiveness ratio to create the 
signature. 

20. The method of claim 19, further comprising continuously updating the created 
signature. 

21. The method of claim 20, further comprising detecting abnormalities based on the 
updated signature. 
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22. The method of claim 19, wherein creating a signature comprises initially 
repeating the running average and standard deviation through a plurality of intervals. 

23. The method of claim 20, wherein updating the created signature comprises using 
a weighting factor to ensure that recently recorded data has a greater impact than older data. 

24. The method of claim 20, wherein updating the created signature comprises 
utilizing a moving average over a time to account for events occurring at unexpected times. 

25. The method of claim 21, wherein detecting abnormalities comprises determining 
if measured values are above an upper threshold or below a lower threshold. 

26. The method of claim 21 , further comprising calculating upper and lower threshold 
limits based on jitter offset. 

27. A computer readable medium having computer executable instructions for 

performing the method of claim 19. 

i 

28. A system for detecting abnormal activity in a computerized environment, the 
system comprising: 

monitoring tools for continuously monitoring a system parameter; 
a continuously updated signature representative of normal values of the system 
parameter; and 

an abnormality indicator calculated based on the continuously updated signature, the 
abnormality indicator including a range of normal values for the system parameter. 
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29. The system of claim 28, wherein the continuously updated signature comprises an 
average and a standard deviation. 

30. The system of claim 28, wherein the continuously updated signature comprises a 
weighting factor to ensure that recently recorded data has a greater impact than older data. 

31. The system of claim 28, wherein the continuously updated signature comprises a 
moving average over time to account for events occurring at unexpected times. 

32. The system of claim 28, wherein the abnormality indicator determines whether a 
monitored system parameter is within a normal range of values and whether monitored system 
parameters are above an upper threshold or below a lower threshold. 

33. The method of claim 28, wherein the abnormality indicator calculates upper and 
lower threshold limits based on jitter offset. 

34. A monitoring system for monitoring a process, the monitoring system comprising: 
a signature creation module for creating a signature representative of the process; 

a signature updating module for continuously updating the created signature; and 
an abnormality detection module for detecting abnormalities based upon deviations from 
the updated signature. 

35. The system of claim 34, wherein the signature creation module includes tools for 
calculating an average and a standard deviation. 
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36. The system of claim 35, wherein the signature creation module comprises tools 
for performing accelerated learning through incrementally increasing a learning responsiveness 
ratio. 

37. The system of claim 35, wherein creating a signature comprises initially repeating 
the running average and standard deviation through a plurality of intervals. 

38. The system of claim 34, wherein the signature updating module comprises a 
weighting factor to ensure that recently recorded data has a greater impact than older data. 

39. The system of claim 34, wherein the signature updating module comprises tools 
for calculating a moving average over a time to account for events occurring at unexpected 
times. 

40. The system of claim 34, wherein the abnormality detection module determines if 
monitored system parameters are above an upper threshold or below a lower threshold. 

41. The method of claim 34, wherein the abnormality detection module includes a 
mechanism for calculating upper and lower threshold limits based on jitter offset. 

42. A method for distinguishing between normal and abnormal behavior during a 
process, the method comprising: 

monitoring a system parameter; 

converting a numeric data stream representative of the monitored system parameter to a 
state for the process; and 

distinguishing between normal and abnormal behavior based on the state. 
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43. The method of claim 42, further comprising converting the numeric data streams 
to multiple sub-states. 

44. The method of claim 42, further comprising determining a root cause of an 
abnormality based on the state. 
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